---
title: "Step 1: Prepare the cluster"
description: "Prepare your Kubernetes cluster for OpenLM Platform: create the namespace, check storage and the ingress controller, and create the DNS name."
product: OpenLM Platform
---

Prepare your cluster for OpenLM Platform: create the namespace, check storage and ingress, create the DNS name, and confirm that pods can reach it. Load the variables from `openlm-install.env`, the file you created from the [installation worksheet](https://www.openlm.com/documentation/cloud/deployment-operations/on-premise/deployment-guide/kubernetes/before-you-start/worksheet):

```bash
source ./openlm-install.env
```

## 1.1 Create the namespace

```bash
kubectl create namespace "$NS"
```

On OpenShift, create a project instead, so the namespace gets its security settings:

```bash
oc new-project "$NS"
```

## 1.2 Check the storage class

```bash
kubectl get storageclass "$STORAGE_CLASS"
```

It must print one line. If it says `NotFound`, list the classes with `kubectl get storageclass` and correct `STORAGE_CLASS` in your worksheet.

## 1.3 Check the ingress controller

Confirm that your cluster has a controller to serve web traffic. OpenLM Platform brings web traffic in through one Ingress object, or through Routes on OpenShift.

```bash
kubectl get ingressclass
```

Your `INGRESS_CLASS` must be in the list. If the list is empty, install an ingress controller first. Your [platform page](https://www.openlm.com/documentation/cloud/deployment-operations/on-premise/deployment-guide/kubernetes/platforms/index) says which one to use. On OpenShift, the built-in router does this job, and you can skip this check.

Then find the controller's **external address**, which is where your DNS name points:

```bash
kubectl get service -A | grep -iE "LoadBalancer"
```

Note the `EXTERNAL-IP` of your ingress controller's service. It's a host name on EKS, an IP on AKS, or your node's IP on K3s.

## 1.4 Create the DNS name

Ask your network team to create a DNS record for `$DOMAIN`:

| Cluster | Record |
|---|---|
| EKS | `CNAME` → the load balancer host name from 1.3 |
| AKS, K3s | `A` → the IP from 1.3 |
| OpenShift | `CNAME` → the cluster's router address (`*.apps.<cluster>` wildcard), or covered by it already |

## 1.5 Raise the node file-watch limit

Set `fs.inotify.max_user_instances` to 8192 on every node. About 85 services start at the same time. On many Linux defaults that exhausts `fs.inotify.max_user_instances` (128), and pods fail with `too many open files`. How to set it depends on the platform: see the **Node settings** section of your [platform page](https://www.openlm.com/documentation/cloud/deployment-operations/on-premise/deployment-guide/kubernetes/platforms/index).

## 1.6 Make the address reachable from inside the cluster

Test now, before anything else depends on it, that pods can reach your web address. Services call `https://$DOMAIN/identity` from inside the cluster. On most cloud clusters this works without changes. On other clusters, pods can't reach the cluster's own load balancer ("hairpin" traffic). Run the test pod:

```bash
kubectl -n "$NS" run nettest --rm -it --restart=Never \
  --image=public.ecr.aws/docker/library/busybox:stable -- \
  sh -c "nslookup $DOMAIN && wget -qO- --no-check-certificate -T 5 https://$DOMAIN/ >/dev/null; echo exit=\$?"
```

Read the result:

- `nslookup` must return an address.
- `exit=0`, or `exit=1` with "404", "503", "TLS error" or "Connection reset by peer", means the connection worked. The platform isn't installed yet, so the ingress answers with an error page or its own default certificate.
- `exit=1` with "timed out" or "can't connect" means pods can't reach the address. Fix it now: [Networking: reaching the platform address from inside](https://www.openlm.com/documentation/cloud/deployment-operations/on-premise/deployment-guide/kubernetes/concepts/networking#reaching-the-platform-address-from-inside-the-cluster).

:::tip[Check]
Confirm these results:

- `kubectl get namespace $NS` shows `Active`.
- `nslookup $DOMAIN` from your workstation returns the address from 1.3.
- The test pod in 1.6 connected.
:::